CVE-2026-16812

This flaw lets a remote attacker send specially crafted requests to VeloCloud Orchestrator and trick it into running operating-system commands. Think of it like someone finding a “maintenance console” hidden behind your front door—once they reach it, they can potentially control the whole system. Because exploitation is confirmed in the wild, unpatched on-prem installations are at real risk.

This matters if you run VeloCloud Orchestrator On-Prem (on your own infrastructure). The hosted and dedicated versions were already patched in advance, so the biggest concern is your on-prem instance being vulnerable and reachable from the network. The risk applies only if you are running an unpatched on-prem version and it’s reachable from the attacker’s network (for example, internet-accessible).

This is RED because the vulnerability is confirmed as actively exploited in the wild and listed in CISA KEV. You should treat this as an emergency for any unpatched VeloCloud Orchestrator On-Prem system, since attackers do not need a login to trigger the flaw. CISA’s due date for applying mitigations is 2026-07-30.

Confirm exposure

• Identify whether you use VeloCloud Orchestrator On-Prem.
• Determine the exact VCO on-prem version number currently installed.
• Confirm whether the orchestrator is reachable from untrusted networks (especially internet access). The findings state this is reachable in default configuration.

Compare to fixed versions (pick the path that matches your version train)

Upgrade to one of the following fixed releases:

• 5.2.3.14 or later (5.2 train)
• 6.1.3.4 or later (6.1 train)
• 6.4.2.4 or later (6.4 train)
• 7.0.0.1 or later (7.0 train)

Upgrade guidance

• Perform the vendor-recommended upgrade to the fixed VCO release “at your earliest convenience.”
• If your current release is not on a supported train, contact Arista TAC to discuss possible upgrade options for your specific version.
• Plan for a controlled maintenance window and ensure backups/rollback plans exist per your internal change process.

If you cannot patch immediately (temporary containment)

• Follow the vendor’s mitigation guidance as closely as possible (per the Arista security advisory referenced in the findings).
• Immediately reduce exposure: ensure the on-prem orchestrator is not reachable from the public internet and only accessible through tightly controlled network paths.
• Because exploitation is reported as active and does not require authentication, prioritize containment + patching in parallel.

Track the remediation deadline

• CISA KEV remediation due date: 2026-07-30.

What to monitor after changes

• Review orchestrator host logs and network access logs for suspicious requests and command-execution indicators.
• Verify system integrity and stability following the upgrade.
• Continue monitoring for continued attempts, since active exploitation is already being reported.

CVE-2026-16812 is an OS command injection (CWE-78) in VeloCloud Orchestrator On-Prem that allows a remote attacker to execute arbitrary commands with elevated privileges without authentication or user interaction. The findings indicate network reachability in default configuration and that exploitation is confirmed in the wild (Arista reports active zero-day exploitation; and CISA KEV lists the vulnerability).

CISA KEV means: once a vulnerability is added, affected organizations are expected to follow CISA guidance to mitigate the risk according to their asset exposure. Here, the due date for applying mitigations is 2026-07-30.

Exploit maturity: active exploitation with no public exploit code on record. The EPSS value is not used for urgency in this case because KEV/news indicate real-world exploitation, which takes precedence.